Methods and systems using an ai co-processor to detect anomolies caused by malware in storage devices

ABSTRACT

Computer implemented systems and methods for performing electromotive force analysis of a storage device that include a storage device, an Artificial Intelligence Co-processor (AI-Coprocessor) chipset, a thin coil inductor positioned in proximity to a portion of the surface of the storage device for capturing data from electro motive radia generated by the storage device, an analog-to-digital-converter, and at least one probe for communicating the captured data to an analog-to-digital converter. The data is captured by the thin coil inductor and communicated to the analog-to-digital-converter via the at least one probe and the analog-to-digital-converter digitizes the voltage level of the captured data and communicates the results of the digitization and amplification to the Ai-Coprocessor. The Ai-Coprocessor chipset performs analysis of the data to detect any anomalies in the operation of the storage device and outputs those result for further processing. Embodiments include the use of an NVM Express protocol or an AHCI controller engine so it can detect in real time any hardware threats or attacks such as side channel attack, power glitch and any other hardware changes. Embodiments can detect malicious activities such as ransomware, virus and malware, or non-malicious activities by measuring the electromotive force energy caused by anomalous activities.

CROSS-REFERENCES TO RELATED PATENT APPLICATIONS

The present application claims benefit of U.S. Provisional ApplicationNo. 62/893,207 filed on Aug. 29, 2019, Singapore Patent Application No:10201907989 W filed on 29 Aug. 2019, and Singapore Patent ApplicationNo. 10202004811X filed on 22 May 2020, each of which are hereinincorporated by reference in their entireties.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

Not Applicable.

REFERENCE TO SEQUENCE LISTING, A TABLE, OR A COMPUTER PROGRAM LISTINGCOMPACT DISK APPENDIX

Not Applicable.

BACKGROUND

Embodiments of the inventive subject matter relate to systems,apparatuses and methods for detecting anomalies in storage devices suchas a Solid State Drive (SSD) and more specifically for independentlydetecting malware attacks using hardware and software.

A common problem with a SSD is keeping stored data safe and secured fromany type of malware attacks such as ransomware attacks while at the sametime monitoring the security of the SSD in real time. Ransomware andother malware threats and attacks have been increasing over timebecoming more and more complex in nature and thus more difficult todetect and neutralize requiring more hardware and software resources onthe part of the system user or manager as well as frequent updates.

Examples of prior art relating to artificial intelligence detectionmethods of threats or anomalous activities such as ransomware, virusesand malware include firmware, software or hardware based solutions. Insome of these prior art examples, the firmware or software solution islocated within the solid state drive controller chipset in line with theoriginal firmware and the elements are dependent on the solid statedrive controller chipset resources. These types of prior artconfigurations can cause time latency in operation due the delays fromthreat analysis activities. In these prior art examples, memoryresources can easily be overloaded in cases where there is insufficientmemory storage (RAM) capacity or an overload of CPU usage, power andcurrent may also occur. These issues can cause leaks of information withspecific types of attacks such as side channel or DPA attacks.

Further, the prior art often has issues with firmware portability as thefirmware in a device needs to be updated when the solid state drivemicrocontroller architecture changes. These updates may require humanintervention which can also lead to an increase in the frequency ofsystem flaws. Additionally, firmware or/software integration failing atthese points could cause the whole solid state drive to becomenonfunctional. In some examples using hardware solutions, the prior artinvolves tampering detection, detecting counterfeit hardware andunauthorized firmware, detection of types of software and firmware thatmay degrade the functionality of the device. In some prior art hardwaresolutions, the methods used focus on functionality that resides in theintegrated circuit flash memory that don't check the integrity of thestored data in the solid state drive NAND flash. Additionally, this typeof prior art monitors data without the use or integration of artificialintelligence.

Additionally, the prior art methods for detecting ransomware attacks insolid state drives using NVM Express protocol or/AHCI. Many also utilizefirmware or software based solutions that require human intervention forcode updates from architecture to architecture. The prior art also hasdelays in the processing of information related to SSD controllerchipset resources such as RAM, DMA, and flash memory as moreinstructions are executed.

SUMMARY

The illustrative embodiments provide computer implemented methods,apparatuses, and systems that utilize state of art technology to detectransomware attack or/threats or/activities that target Solid State Drive(SSD) storage devices by applying an Artificial IntelligenceCo-processor (AI-Coprocessor) to monitor the Input and/or Output of NVMExpress protocol or AHCI commands of the Solid State Drive controllerchipset, in linear by measuring the electromotive force energy caused bysolid state driver during the execution of NVM Express protocol or AHCIcommands. As the integrity of data become vital, embodiments of theclaimed subject matter allow users and administrators an extra layer ofsecurity against ransomware threats or attacks which can be difficult todetect by a conventional security tools.

Many of the described embodiments include a flexible printed circuitboard, a rigid Flex printed circuit board and/or a rigid printed circuitboard. Further, many of these boards have a low profile thickness. Thepresent embodiments allow scalability to be integrated with any existingSolid State Drive format.

The embodiments also include the use of an ASIC, a FPGA and/or anembedded FPGA with passive components and/or active components populatedin single printed circuit board for system integration. Embodiments alsointegrate ASIC, FPGA and/or embedded FPGA with a solid state driverchipset or, in some embodiments, the components can be placed betweenthe solid state drive printed circuit board and a protection cover. Inother embodiments, components may be positioned as an overlay printedcircuit board using the same or similar profile of the targeted solidstate drive printed board layout. In some of these embodiments, a smallinduction or/inductance can be placed on the top of or next to the solidstate drive integrated circuit so that the embodiment is connecteddirectly to the circuit via a connector or/thru-hole soldered in theprinted circuit board of the A-Coprocessor.

In many of these embodiments, the AI-Coprocessor is programmed to haveself-training or self-learning mode. During the self-training orself-learning mode, the solid state driver device can execute a seriesof predefined NVM Express protocols and/or AHCI commands over aspecified time of period. During this execution, the AI-Coprocessorreceives the data flow from solid state drive device through a securecommunication bus such a I2C protocol, a SPI protocol, a USB, an LVDSand/or any specified protocol defined by the user or predefined at thefactory. In these embodiments, the AI-Coprocessor uses an externalor/internal Analog-to-Digital Converter with a high resolution bits tomeasure the electromotive force energy generated by the solid statedriver controller chipset in linear mode for generating one or moresignature patterns that are presented in series of binary or hex codes.These codes may then be saved, for instance inside one or moreAI-Coprocessor secure flash storage elements. In these embodiments, thegenerated patterns may have a rich value as well as a lean value andthese values can be used as thresholds limits for any anomalous threats,attacks and/or activities such as those caused by malware or ransomware.

Embodiments can also provide convolution layers of algorithm modulesembedded inside the AI-Coprocessor to enable the embodiment with theability to train itself without utilizing a external deep learning modelwhile still enabling real time monitoring of the integrity of storeddata.

Many of the embodiments operate by interfacing or placing a dedicatedhardware AI-Coprocessor which leads to an increase in the performance ofthe device, reliability of the security, and a reduction in the timelatency by eliminating the target solid state driver RAM from overflowusing independent resources including hardware such as flash memory andother types of memory such as RAM. Some embodiments operate in afailsafe mode by using ultra lower power voltage.

Many embodiments are linked to or in communication with the target solidstate drive controller via a secured connections bus. Some embodimentsuse a smart algorithm for early detection of a threat attack such as amalware or ransomware attack before the attack is able to spread. Theembodiments herein can used with a number of different integratedcircuit packages, for example embodiments can be integrated with anysolid state drive controller architecture without needing firmwareupdates or synchronization with the target solid state drive controller.

Many of the present embodiments allow for a significant reduction in thetime to market while at the same time providing a reliable method tomonitor the integrity of data and related operations of associateddevices that relate to firmware and controller methods integrated withone or more solid state drives. In an exemplary attack, a ransomwareattack executes one or more sequences of NVMe or AHCI commands using thehost system top level outside of the firmware of the target solid statedriver integrated circuit flash. In response, an embodiment will sampleor measure the electromotive force energy generated by ransomwareactivities and operations through the solid state drive using the NVMeprotocol or the AHCI protocol. During the attack activity period, theransomware attack includes harmful sequences of NVMe/or AHCI commandsthat results in the target solid state driver integrated circuitgenerating a series of electromotive force signatures which are uniquefrom other threats.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the claimed subject matter present invention will aredescribed by way of example with reference to the accompanying drawings,wherein:

FIG. 1 illustrates a block diagram schematic that shows the modules ofan AI-Coprocessor with external integrated circuit blocks showing aransomware detector running in conjunction with a Solid State Drive withNVMe Protocol or AHCI protocol according to embodiments of the claimedsubject matter;

FIG. 2 illustrates three dimensional views of solid state drive with aform factor of a M.2 modular card integrated in a printed circuit boardaccording to embodiments of the claimed subject matter;

FIG. 3 illustrates atop broken down view of a modular M.2 card with asolid state drive controller integrated with an AI-Coprocessorransomware detector configured as a hardware solution according toembodiments of the claimed subject matter;

FIG. 4 illustrates a correlation of NVMe/AHCI commands against measuredVemf linearly with the time according to embodiments of the claimedsubject matter;

FIG. 5A illustrates an exemplary voltage level of electromotive forceenergy with an anomaly such as a ransomware present and with a normaloperation mode linear to time according to embodiments of the claimedsubject matter;

FIG. 5B illustrates a cross-correlation of a sampled bytes of NVMe/AHCIbuffered command with ransomware or an exemplary anomaly detectedaccording to embodiments of the claimed subject matter; and

FIG. 6 illustrates a system of the AI-Coprocessor interconnectionsaccording to embodiments of the claimed subject matter.

DETAILED DESCRIPTION OF THE EMBODIMENTS

According to embodiments of the claimed subject matter, variousapparatuses, systems and methods systems for detecting malware includingattacks by malware including ransomware.

Embodiments can be used to protect data stored inside storage usingartificial intelligence by sampling electromotive force caused bycurrent flow for anomalies which indicate possible malware or otherthreats. Anomalies include variations in input/output activities of astorage device such as those found during the access of logical blockaddresses by ransomware.

In many of the current embodiments, an AI-Coprocessor is interfaced orpositioned in proximity to a solid state drive controller chip-set usingNVM Express protocol or AHCI. In several embodiments, the AI-Coprocessorcan be placed with or inline or on top side of solid state drivecontroller chip. In some embodiments, the AI-Coprocessor is embedded ina custom made ASIC, an embedded FPGA or a SoC+FPGA as a single core ormulti-cores.

These embodiments will run independently from the solid state drivecontroller chip-set resources detecting ransomware attacks in real time.In one use example, each of many threats or attacks have their ownelectromotive force (EMF) pattern signature, and these signatures areused for further analysis and comparison to one or more solid statedrive controller chip-set electromotive forces (EMF) in normaloperations.

Many of the described embodiments provide a user friendly solution tointegrate the embodiments with an existing solid state drive controllerintegrated circuit board, with a standard communication bus that allowsscalability with any type of Solid State Drive using NVM Expressprotocol and/or AHCI. The malware detection feature is based in theAI-Coprocessor which has a dedicated bus communication link with solidstate drive controller integrated circuit via a defined secure protocol.All NVMe sequences, including admin sequences commands and usersequences commands, can be shared in real time with the AI-Coprocessor.The AI-Coprocessor will measure the electromotive force (EMF) that isgenerated by the integrated circuit of the solid state drive chipset, inconjunction with any NVMe, any AHCI Sequences, any NVMe, or any AHCIstreams received, in any normal operations condition as well as duringmalware (including ransomware) attacks.

One advantage of many of the embodiments is a real time analysis withtime latency minimization that can be helpful for use with Cloud StorageServer Applications or High Platform Servers applications. Many of theseembodiments allow for early malware/ransomware detection that aids withthe elimination of false detection numbers leading to a higher accuracyrate for detecting threats and attacks from malware includingransomware.

In many of the embodiments, the electromotive force energy measured isconverted to a digital signal using an analog digital controller, andthen resulting signals are computed or converted by different signalsconvolutions algorithms in line with time series analysis and/orcompared against a large number of stored threat patterns, malwarepatters, and/or ransomware patterns. The number of patterns used forcomparisons can be into the millions. Other embodiments use one or moreself-training modules (within or external to the AI-Coprocessor) thatrun during the normal operations of the Solid State Driver Controller tomake comparisons of any number and types of suitable patterns.

In many of these embodiments used to detect ransomware, when the timecriteria of a ransomware score, a threshold, or a correlationcoefficient reach the predetermined or real time determined level ofransomware threats, the AI-Coprocessor will trigger the alarm throughGeneral Purpose Input/Output Bus to alert the solid state drivecontroller to take further precautions and execute one or morecorresponding configurations. Many of these embodiments operateindependently from the solid state drive power source and they includededicated internal RAMs, Flash memory and one or more communicationsperipherals. Other embodiments may have different configurations ofcomponents. Embodiments can take the format of any conventional ASICsolutions package including but not limited to a BGA, a CSP or as abitstream file to operate from any FPGA and/or any embedded FPGA. Thepreferred embodiment is campaigned with external integrated circuit tomeasure or capture electromotive force energy and with passive andactive components.

The present embodiments are not limited to unique configurations todetect threats and attacks from malware, viruses, ransomware or anyother type of attack on a solid state drive supporting NVMe protocol orAHCI protocol. Embodiments can use any number of implementations andinterfaces to the hardware being monitored, for example any targetingprotocol such as NVMe-oF protocol that is related to storage such asstorage used in systems like SaaS systems.

In many of the embodiments, protocol targeting for NVme and AHCI is usedbut varieties may also be used alone or in conjunction with otherprotocols. For example, the NVMeOF (MVMe over Fabric) could be used inconjunction with the AI core. These protocols can also be used tomonitor activities as well as train the embodiments to recognizeabnormal activities with any types of protocols. Some of these describedembodiments would utilize further software integration.

In many of these embodiments, a number of different threats can bemonitored as well as any unusual activities related to the hardware suchas certain patterns of usage or patterns indicating the storage is beingpartially or completely duplicated. For example, a higher amount ofusage compared to a normal usage may indicate an improper activityrelated to the storage device.

Turning now to the figures, FIG. 1 illustrates a block diagram of anexemplary hardware system 100 based in an AI-Coprocessor Chipset fordetecting ransomware involving a solid state drive controller utilizingthe electromotive force energy generated by the solid state drivechipset during the running time in correspondence with an NVMe protocolor with an AHCI protocol. The hardware system 100 includes anAI-Coprocessor Chipset 120 interfaced in the same printed circuitthrough a predefined communication bus with a Solid State Drive Board142. During the Power-On state of the hardware system 100, power isprovided by an PMIC 141 integrated circuit with the power output valueable to be configured by the AI-Coprocessor 120 if desired.

After the power status is indicated as valid, the hardware system 100starts sampling electromotive force energy generated by the Solid StateDrive Board 142 or the Solid state Driver controller 142 using a smallinductance coil 110. Other embodiments may use a larger or smallerinductance coil or another data gathering component known to thoseskilled in the art. In these embodiments, the AI coprocessor handlesrecognizing activities or threats by extracting attributes in themeasured data. Embodiments using the AI coprocessor will decrease anylatency delay when analyzing the captured data but other embodimentsusing a non AI coprocessor may also be used to analyze the captureddata.

The inductor or inductance coil could be a thin form factor, for examplein use with a M.2 SSD format, or it could be any other suitable size.For example, in some installations such as a datacenter with limitedspace within each server housing or when placed in use with alaptop/notebook device, a smaller or thinner form factor can be used.Some of these embodiments can be placed in proximity to a M.2 PCButilizing any available space inside the housing, for instance in alaptop casing having a 1.35 mm thickness (the gap between Motherboardand M.2 PCB), a thin inductor placed in proximity to the storage devicemay be used.

In this embodiment, the energy crossing the inductance coil 110 issampled by the Analog-to-Digital Converter 140 and the sampled value ispassed to the AI-Coprocessor Chipset 120 through one or moredifferential signals. The data buffer of the Analog-to-Digital Converter140 is held temporarily in the DIFF-SIGNAL 121 dedicated register andpassed to the dedicated Digital filter 122 for further processingagainst comparisons of unwanted signals. In many embodiments, thefiltering of unwanted signals is achieved with one or more softwarealgorithms that each may depend on one or more user predefined settingsas well as one or more calibrations and thus, the embodiments may not belimited to single state machine. In some embodiments, a singleAI-Coprocessor Chipset may be used but in other embodiments, a single ormultiple AI-Coprocessor Chipsets could be used in conjunction with oneor more cores in parallel or in serial arrangement within some workingtogether to process captured data.

A hardware TIMER module 123 logs the one or more time periods of thedigital filter 122. The NVMe/AHCI module 124 logs all commands of theNVMe protocol or the AHCI protocol which have been executed through theI/O Bus module 125 programmed with an SPI protocol or/I2C or any highspeed communication control, in conjunction with the Solid State DriveBoard 142 or a Solid State Driver Controller IC 142.

After a pre-defined period of data sampling from all three of themodules (the DIGITAL FILTER 122, the TIME 123 and the NVMe/AHCI 124)with all the data from those modules being transferred through internalbus data within the AI-Coprocessor 120 to a DIGITAL SIGNAL PROCESSINGALGORITHM 126 for further transformation including applying one or moredifferent calculations depending on how the sequences are configured bythe user. The results of the one or more calculations, for examplebuffer frames generated by the DIGITAL SIGNAL PROCESSING ALGORITHM 126,are communicated to the Spectral Image generator 127 module, and thegenerated image will be matched by a DSP or/SoC with Neural networkalgorithm 128 against a self-trained image pattern inside the internalFlash 129.

If no match, partial match, or other solution results show a potentialransomware threat, the external Secure-Flash 143 Integrated Circuit inqueried. If a ransomware state pattern is detected, for example usingthe DSP or/SoC with Neural network algorithm 128, the system willinterrupt the security alert Output Pin of the I/O Bus 130 to the SolidState Drive Board 142 or/Solid State Driver Controller IC 142. When thesecurity events cause an interruption, the State Drive Board 142or/Solid State Driver Controller IC 142 can take further one or morefurther actions depending on one or more predefined configurationsinstalled by the user and/or the manufacturer. An interruption of thesystem can be accomplished any number of ways known to those skilled inthe art, for example with the use of a physical bus line if the AICoprocessor is placed within the an IC, or by a firmware code if the AICoprocessor is integrated with the SSD controller in which the interruptcould be accomplished by writing a predefined register inside thechipset. In other embodiments, a proprietary SSD IC controller used byan OEM factory could be configured through at least one I/O connectionbus to share activities and exchange attributes collected from the SSDcontroller including attributes such: EMF values versus time. Otherembodiments can use a Diewafe solution (ASIC HW IP) in which the Ai corecould be converted from RTL to GDS format. Yet other embodiments couldbe implemented within one or more parallel cores by softwareimplementation.

In some embodiments, further steps or actions may include limitingaccess to the stored data, communicating one or more alerts such assending one or more alert beams through an external wireless connectionor a wired connection or both, locking the storage device or a componentwithin the storage device or a component external to the storage device,and/or allowing read only mode without the ability to overwrite anystored data.

In many of the embodiments, self-training may be used to allow theAI-Coprocessor Chipsets to learn what is normal and what is abnormal. Inone example, the AI-Coprocessor Chipset uses a dataset for referenceagainst other datasets utilizing one or more levels of tolerance in theone or more comparisons. In one exemplary self-training embodiment, anormal operation threshold setup uses digital values of one or morepredefined attributes. In some embodiments, the artificial intelligencealgorithm running in the AI-Coprocessor Chipset compares the currentoperation dataset to the normal or baseline operation dataset while atthe same time uses the currently incoming datasets to update or modifythe dataset in use without needing external input values.

FIG. 2 illustrates three dimensional view of a Solid State Drive withform factor of a M.2 modular card. This embodiment is integrated in thesame printed circuit board 200. NAND flash modules 201, 202, 203 and 204are placed in series and have direct connections with the Solid StateDrive controller I 205. Additionally, this embodiment is placed withinboundary guard trace 211 allowing the AI-Coprocessor 216 to be protectedagainst unintentional signals and isolating the incoming sensitivesignals from other high speed signals that may interfere with theembodiment. An inductance coil 220 placed on the top of the Solid StateDriver Controller 205 captures generated electromotive force energywhich is linked to the Analog-to-Digital Converter 212 by 2 differentialsignals wires 221 and 222. The inductance coil 220 may be placed in anylocation in proximity to the Solid State Driver Controller 205 whereinreadings can be made.

In this embodiment, during the ransomware detection process, an externalsecure Flash 213 is used as a database for ransomware pattern data. Anyother storage medium known to those skilled in the art may also be used.All components within the area boundary 210 are powered by a dedicatedPower Management Unit 215 together in conjunction with the passivecomponents 214. These embodiments illustrate an example of one hardwaresolution for the ransomware detector configuration that can be used toprotect any type of M.2 modular card. Other configurations known tothose skilled in the art that achieve the same results with differentcomponents can also be used such as any standard storage device layoutformat for example M.2.

FIG. 3. illustrates a top broken out view of a modular M.2 card 300 witha solid state drive controller integrated with an AI-Coprocessorransomware detector configured as a hardware solution according toembodiments of the claimed subject matter. The embodiment is placed inarea 301 and protected by guard trace boundary 305. The inductance coil304 is a flexible Printed Circuit Board used to capture electromotiveforce energy and inductance coil 304 is connected within area 301through pair of signal wires. In this embodiment, the first wire ispositive signal 302 and second wire is negative signal 303. Also in thisembodiment, the components are placed very close to PCIe power padstrace 306 in order to reduce power noise.

FIG. 4 illustrates the correlation of NVMe/AHCI commands againstmeasured Vemf linearly with the time as shown in graph 310. The pointsin the graph 310 represent a group of bytes sampled within a time periodof 5 milliseconds wherein an NVMe/AHCI Write command 311 is executedconsecutively which leads to the Solid State Controller Chipsetoverloading more current flows. This configuration causes an increase inthe electromotive force energy that can surpass the threshold of theransomware detect value which is shown in the graph 310 by the dashedline 312. This graph 310 illustrates one example of a precomputed methodused to detect ransomware. The aforementioned time period may be a widerange, for example a nanosecond to one second, depending on the needs ofthe user and/or manufacture, for example a time period optimized for aspecific SSD controller, storage device or other hardware component.

FIG. 5A illustrates an exemplary voltage level of electromotive forceenergy with an anomaly such as a ransomware presence and with a normaloperation mode linear to time shown in the graph 320. As seen, theanomaly such as one caused by ransomware runs slightly different fromthe normal operation of the NVMe/AHCI. During this process, theelectromotive force energy causes the solid state drive chipset toexecute more instructions, and this increase in instructions leads tothe increase of current flowing along integrated circuit signal. Theslight difference of this anomaly (in this instance caused by thepresence of ransomware) captured is shown with the dashed line 321. Thegraph 320 shows that greater electromotive force energy is generatedcompared to that generated during the normal operation of NVMe/AHCIexecuted commands. This difference shows the value of usingelectromotive force energy to identify anomalies.

FIG. 5B illustrates a cross-correlation of a sampled bytes of NVMe/AHCIbuffered commands with ransomware or an exemplary anomaly detectedaccording to embodiments of the claimed subject matter and morespecifically it shows a cross-correlation of a sampled bytes ofNVMe/AHCI buffered command with ransomware or other anomaly detected inthe graph 330. The measured value of an anomaly (such as ransomwareactivity) is shown in dashed line 331 and this measured value has apositive correlation with the measured value of NVMe/AHCI commandspresent during normal operations shown in line 333. This type ofanalysis can help avoid false positives such as those due to erase/wipecommands of NVMe/AHCI occurring in normal operations that couldotherwise cause a fault alert of the presence of an anomaly such asransomware. By setting the threshold score between 9 and 10 in graph330, the peak anomaly or/ransomware can be detected when it exceeds thethreshold value presented as dashed line 332 allowing the anomaly suchas ransomware to be detected in an early stage before it is allowed todestroys files or do other types of damage.

FIG. 6 illustrates a system of the AI-Coprocessor unit interconnectionsaccording to embodiments of the claimed subject matter. In theseembodiments, three external variables are used for further digitalcomputing. These variables are the NVMe/AHCI variable 430 three bits,where MSB presents NVMe/AHCI Write command, the second bit presents theRead command and the LSB presents the ERASE/Delete command. A value of 0or 1 is presented when one of the commands is captured in thecorresponding bit location. Secondly, the measured electromotive forceenergy values 420 is presented in thirty-two bits and finally the timervalue 410 is also presented in thirty-two bits. These external valuesare temporarily held in buffer registers: the NVMe/AHCI three-bitregister 443, the voltage value of electromotive force energy 32-bitregister 442 and the timer register 441. In other embodiments, thenumber of variables could be more or less than three.

The sub module 454 of the AI-Coprocessor system 440 is the first modulethat initiates the computing of buffer values using two DFT (DiscreteFourier Transformation) engines. The correlation analysis engine 446calculates the cross-correlation of the two signals that come from thefirst DFT 445 and the second DFT 444. The correlation analysis engine446 then transfers the calculated DFT 445 and DFT 444 values togetherwith the calculated cross-correlation dimensions values to theransomware score validation engine 447 which is located in sub-module455. If the score is greater than the threshold value, both values ofDFT 445 and DFT 444 are transferred to the FFT (Fast FourierTransformation) engine 448 and the resulting FFT 448 values are then bythe Neural Network Engine 449 in sub-module 453 as a spectral image.This spectral image is compared against a database of anomalyor/Ransomware spectral image signatures that are preloaded,pre-calculated and/or trained by the Neural network Engine 449. In orderto have access to the database, the neural network engine 449 operates asequence of read and write commands through the memory controller 450.The specific protocol bus in bi-directional mode 451 reads the targetflash memory circuit. If the Neural network engine 449 computationdetects an anomaly such as ransomware leading to a match, the neuralnetwork engine 449 sends a signal alert to the targeted solid statedrive controller through a bus line 452.

Tables 1 and 2 show exemplary algorithms according to embodiments of theclaimed subject matter although any other suitable algorithm known tothose skilled in the art may be used.

TABLE 1   Algorithms: Convolution algorithm  1: procedure CONV_AB(a, b) 2:  c ← (60 × 1) zero vector  3:  for h ← 1, 60 do  4:   h⁻¹ ← invA5(h) 5:   for g ← 1, 60 do  6:    k ← opA5(g, h⁻¹)  7:    c(g) ← c(g) + a(k)· b(h)  8:   end for  9:  end for 10:  return c 11: end procedure

TABLE 2   Decision tree algorithm: INPUT: S, where S = set of classifiedinstances OUTPUT: Decision Tree Require: S ≠ ∅, num_attributes > 0  1:procedure BUILDTREE  2:  repeat  3:   maxGain ← 0  4:   splitA ← null 5:   e ← Entropy(Attributes)  6:   for all Attributes a in S do  7:   gain ← InformationGain(a, e)  8:    if gain > maxGain then  9:    maxGain ← gain 10:     splitA ← a 11:    end if 12:   end for 13:  Partition(S, splitA) 14:  until all partitions processed 15: endprocedure

In some embodiments, the platforms, systems, media, and methodsdescribed herein include a digital processing device, or use of the sametype of device. In many embodiments, the digital processing deviceincludes one or more hardware central processing units (CPUs) or generalpurpose graphics processing units (GPGPUs) that carry out the functionof the device or devices. In some embodiments, the digital processingdevice further comprises an operating system configured to performexecutable instructions. In many embodiments, the digital processingdevice is optionally connected to a computer network. In furtherembodiments, the digital processing device is optionally connected to anetwork such as the internet which gives it the ability to reach serverslocated on the World Wide Web. In still further embodiments, the digitalprocessing device is optionally connected to a cloud computinginfrastructure. In other embodiments, the digital processing device isoptionally connected to an intranet. In other embodiments, the digitalprocessing device is optionally connected to a data storage device.

In accordance with the description herein, suitable digital processingdevices include, by way of non-limiting examples, server computers,desktop computers, laptop computers, notebook computers, sub-notebookcomputers, netbook computers, netpad computers, set-top computers, mediastreaming devices, handheld computers, internet appliances, mobilesmartphones, tablet computers, personal digital assistants, video gameconsoles, and vehicles.

Those of skill in the art will recognize that many smartphones aresuitable for use in the system described herein. Those of skill in theart will also recognize that select televisions, video players, anddigital music players with optional computer network connectivity aresuitable for use in the embodiments described herein. Suitable tabletcomputers include those with booklet, slate, and convertibleconfigurations, known to those of skill in the art.

In some embodiments, the digital processing device includes an operatingsystem configured to perform executable instructions. The operatingsystem is, for example, software, including programs and data, whichmanages the device's hardware and provides services for execution ofapplications. Those of skill in the art will recognize that suitableserver operating systems include, by way of non-limiting examples,FreeBSD, OpenBSD, NetBSD®, Linux, Apple® Mac OS X Server®, Oracle®Solaris®, Windows Server®, and Novell® NetWare®.

Those of skill in the art will recognize that suitable personal computeroperating systems include, by way of non-limiting examples, Microsoft®Windows®, Apple® Mac OS X®, UNIX®, and UNIX-like operating systems suchas GNU/Linux®. In some embodiments, the operating system is provided bycloud computing. Those of skill in the art will also recognize thatsuitable mobile smart phone operating systems include, by way ofnon-limiting examples, Nokia® Symbian® OS, Apple® iOS®, Research InMotion® BlackBerry OS®, Google® Android®, Microsoft® Windows Phone® OS,Microsoft® Windows Mobile® OS, Linux®, and Palm® WebOS®.

Those of skill in the art will also recognize that suitable mediastreaming device operating systems include, by way of non-limitingexamples, Apple TV®, Roku®, Boxee®, Google TV®, Google Chromecast®,Amazon Fire®, and Samsung® HomeSync®. Those of skill in the art willalso recognize that suitable video game console operating systemsinclude, by way of non-limiting examples, Sony® PS3®, Sony® PS4®,Microsoft® Xbox 360®, Microsoft Xbox One, Nintendo® Wii®, Nintendo® WiiU®, and Ouya®.

In some embodiments, the device includes a storage and/or memory device.The storage and/or memory device is one or more physical apparatusesused to store data or programs on a temporary or permanent basis. Insome embodiments, the device is volatile memory and requires power tomaintain stored information. In some embodiments, the device isnon-volatile memory and retains stored information when the digitalprocessing device is not powered. In further embodiments, thenon-volatile memory comprises flash memory. In some embodiments, thenon-volatile memory comprises dynamic random-access memory (DRAM). Insome embodiments, the non-volatile memory comprises ferroelectric randomaccess memory (FRAM). In some embodiments, the non-volatile memorycomprises phase-change random access memory (PRAM). In otherembodiments, the device is a storage device including, by way ofnon-limiting examples, CD-ROMs, DVDs, flash memory devices, magneticdisk drives, magnetic tapes drives, optical disk drives, and cloudcomputing based storage. In further embodiments, the storage and/ormemory device is a combination of devices such as those disclosedherein.

In some embodiments, the platforms, systems, media, and methodsdisclosed herein include one or more non-transitory computer readablestorage media encoded with a program including instructions executableby the operating system of an optionally networked digital processingdevice. In further embodiments, a computer readable storage medium is atangible component of a digital processing device. In still furtherembodiments, a computer readable storage medium is optionally removablefrom a digital processing device. In some embodiments, a computerreadable storage medium includes, by way of non-limiting examples,CD-ROMs, DVDs, flash memory devices, solid state memory, magnetic diskdrives, magnetic tape drives, optical disk drives, cloud computingsystems and services, and the like. In some cases, the program andinstructions are permanently, substantially permanently,semi-permanently, or non-transitorily encoded on the media.

In many embodiments, the platforms, systems, media, and methodsdisclosed herein include at least one computer program, and/or use ofthe same. A computer program includes a sequence of instructions,executable in the digital processing device's CPU, written to perform aspecified task. Computer readable instructions may be implemented asprogram modules, such as functions, objects, Application ProgrammingInterfaces (APIs), data structures, and the like, that performparticular tasks or implement particular abstract data types. In lightof the disclosure provided herein, those of skill in the art willrecognize that a computer program according to the described embodimentsmay be written in various versions of various languages.

The functionality of the computer readable instructions may be combinedor distributed as desired in various environments. In some embodiments,a computer program comprises one sequence of instructions. In someembodiments, a computer program comprises a plurality of sequences ofinstructions. In some embodiments, a computer program is provided fromone location. In other embodiments, a computer program is provided froma plurality of locations including programs embedded or located inhardware. In various embodiments, a computer program includes one ormore software modules. In various embodiments, a computer programincludes, in part or in whole, one or more web applications, one or moremobile applications, one or more standalone applications, one or moreweb browser plug-ins, extensions, add-ins, or add-ons, or combinationsthereof.

Some embodiments include a relational database management system(RDBMS). Examples of suitable RDBMSs include Firebird, MySQL,PostgreSQL, SQLite, Oracle Database, Microsoft SQL Server, IBM DB2, IBMInformix, SAP Sybase, SAP Sybase, Teradata, and the like. Those skilledin the art will recognize that there are a large number of hardware andsoftware configurations are available to achieve the results of theembodiments without departing from the scope of the claimed subjectmatter.

In some embodiments, a computer program used with the describeembodiments includes a standalone application, which is a program thatis run as an independent computer process, not an add-on to an existingprocess, e.g., not a plug-in. Those of skill in the art will recognizethat standalone applications are often compiled. A compiler is acomputer program(s) that transforms source code written in a programminglanguage into binary object code such as assembly language or machinecode. Suitable compiled programming languages include, by way ofnon-limiting examples, C, C++, Objective-C, COBOL, Delphi, Eiffel,Java™, Lisp, Python™ Visual Basic, and VB .NET, or combinations thereof.Compilation is often performed, at least in part, to create anexecutable program. In some embodiments, a computer program includes oneor more executable compiled applications. These applications or programsmay be used with various embodiments of the claimed subject matter.

In some embodiments, the platforms, systems, media, and methodsdisclosed herein include software, server, and/or database modules, oruse of the same. In view of the disclosure provided herein, softwaremodules are created by techniques known to those of skill in the artusing machines, software, and languages known to the art. The softwaremodules disclosed herein are implemented in any number of ways. Invarious embodiments, a software module comprises a file, a section ofcode, a programming object, a programming structure, or combinationsthereof. In further various embodiments, a software module comprises aplurality of files, a plurality of sections of code, a plurality ofprogramming objects, a plurality of programming structures, orcombinations thereof. In various embodiments, the one or more softwaremodules comprise, by way of non-limiting examples, a web application, amobile application, and a standalone application. In some embodiments,software modules are in one computer program or application. In otherembodiments, software modules are in more than one computer program orapplication. In some embodiments, software modules are hosted on onemachine. In other embodiments, software modules are hosted on more thanone machine. In further embodiments, software modules are hosted oncloud computing platforms. In some embodiments, software modules arehosted on one or more machines in one location. In other embodiments,software modules are hosted on one or more machines in more than onelocation.

In some embodiments, the platforms, systems, media, and methodsdisclosed herein include one or more databases, or use of the same. Inview of the disclosure provided herein, those of skill in the art willrecognize that many databases are suitable for storage and retrieval ofcontent and related information such as one or more recordings andindexes of the one or more recordings. In various embodiments, suitabledatabases include, by way of non-limiting examples, relationaldatabases, non-relational databases, object oriented databases, objectdatabases, entity-relationship model databases, associative databases,and XML databases. Further non-limiting examples include SQL,PostgreSQL, MySQL, Oracle, DB2, and Sybase. In some embodiments, adatabase is internet-based. In further embodiments, a database isweb-based. In still further embodiments, a database is cloudcomputing-based. In other embodiments, a database is based on one ormore local computer storage devices including SSD devices.

What is claimed is:
 1. A computer implemented system for performingelectromotive force analysis of a storage device comprising: a storagedevice; an Ai Co-processor chipset; a thin coil inductor positioned inproximity to a portion of the surface of the storage device forcapturing data from electro motive radia generated by the storagedevice; an analog-to-digital-converter; and at least one probe forcommunicating the captured data to an analog-to-digital converter;wherein the data is captured by the thin coil inductor and communicatedto the analog-to-digital-converter via the at least one probe; whereinthe analog-to-digital-converter digitizes the voltage level of thecaptured data and communicates the results of the digitization andamplification to the Ai-Coprocessor; and wherein the Ai-Coprocessorchipset performs analysis of the data to detect any anomalies in theoperation of the storage device and outputs those result for furtherprocessing.
 2. The computer implemented system for performingelectromotive force analysis of a storage device of claim 1 wherein thestorage device is a solid state drive.
 3. The computer implementedsystem for performing electromotive force analysis of a storage deviceof claim 2 further comprising: a solid state drive SoC controller; and acircuit chipset in communication with the solid state drive SoCcontroller; wherein the solid state drive SoC controller monitors thehardware performance of the solid state drive by measuring electromotiveforce of the solid state drive and communicates the measuredelectromotive force data to the AI-Coprocessor;
 4. The computerimplemented system for performing electromotive force analysis of astorage device of claim 3 wherein the Ai-Coprocessor chipset performsanalysis to provide real time protection against any anomalies in theoperation of the solid state drive.
 5. The computer implemented systemfor performing electromotive force analysis of a storage device of claim4 wherein the Ai-Coprocessor is interfaced with the Solid state driveutilizing NVMe protocol.
 6. The computer implemented system forperforming electromotive force analysis of a storage device of claim 4wherein the Ai-Coprocessor is interfaced with the Solid state driveutilizing AHCI protocol.
 7. The computer implemented system forperforming electromotive force analysis of a storage device of claim 4wherein the anomaly activities are caused by malware and wherein thefurther processing interrupts the operation of the solid state drive. 8.The computer implemented system for performing electromotive forceanalysis of a storage device of claim 4 wherein the AI-CoProcessorapplies artificial intelligence algorithms to detect ransomwareactivities.
 9. The computer implemented system for performingelectromotive force analysis of a storage device of claim 8 wherein whenthe ransomware activities are detected, the operation of the solid statedrive is interrupted.
 10. A computer implemented method for performingelectromotive force analysis of a storage device comprising the stepsof: capturing data from electro motive radia generated by a storagedevice using a thin coil inductor positioned in proximity to a portionof a surface of a storage device; communicating the captured data to ananalog-to-digital-converter via at least one probe; digitizing thevoltage level of the captured data using the analog-to-digitalconverter; communicating the voltage level to an Ai-Coprocessor;analyzing the voltage level using the Ai-Coprocessor to detect anyanomalies in the operation of the storage device; and outputting thoseresult for further processing.
 11. The computer implemented method forperforming electromotive force analysis of a storage device of claim 10wherein the storage device is a solid state drive.
 12. The computerimplemented method for performing electromotive force analysis of astorage device of claim 11 further comprising the step of: monitoringthe hardware performance of the solid state drive by measuringelectromotive force of the solid state drive with a solid state driveSoC controller and a circuit chipset in communication with the solidstate drive SoC controller; communicating the measured electromotiveforce data to the AI-Coprocessor; using the Ai-Coprocessor to analyzethe measured electromotive force data; and outputting the results of theanalysis to provide real time protection against any anomalies in theoperation of the solid state drive.
 13. The computer implemented methodfor performing electromotive force analysis of a storage device of claim12 wherein the Ai-Coprocessor chipset performs analysis to provide realtime protection against any anomalies in the operation of the solidstate drive.
 14. The computer implemented method for performingelectromotive force analysis of a storage device of claim 11 wherein theAi-Coprocessor is interfaced with the Solid state drive utilizing NVMeprotocol.
 15. A computer implemented method for performing electromotiveforce analysis of a storage device of claim 11 wherein theAi-Coprocessor is interfaced with the Solid state drive utilizing AHCIprotocol.
 16. A computer implemented method for performing electromotiveforce analysis of a storage device of claim 11 wherein the anomalyactivities are caused by malware and further comprising the step of:interrupting the operation of the solid state drive when an anomalycaused by malware is detected.
 17. A computer implemented method forperforming electromotive force analysis of a storage device of claim 12wherein the Ai-Coprocessor utilizes artificial intelligence algorithmsto detect ransomware activities.
 18. The computer implemented method forperforming electromotive force analysis of a storage device of claim 17further comprising the step of: interrupting the operation of the solidstate drive when the ransomware activities are detected by theAi-Coprocessor.